1. Field of the Invention
The present invention relates to a storage area network (SAN) that includes storage devices accessible by remote clients and that is configured to allow input/output (I/O) data transport over the SAN.
2. Background Art
A storage area network (SAN) typically connects to a local area network (LAN) or other network through a server or servers. The server or servers are connected to storage devices within the SAN to allow remote clients to store/retrieve data to/from the storage devices. The SAN is configured to allow input/output (I/O) data transport, and may utilize any suitable protocol.
One suitable protocol is internet small computer system interface (iSCSI). iSCSI is an emerging protocol which enables remote access to SCSI devices (tapes, drives, libraries . . . ). Instead of requiring a direct physical link to the device (limited in length and number of accessible peripherals), iSCSI enables sending SCSI commands (inquiry, request sense . . . ) over internet protocol (IP) networks. However, iSCSI alone is not security-aware, and anybody can sniff the IP network, read sent data, or even modify it. Consequently, it has been suggested to use iSCSI on top of a secure internet protocol security (IPSec) link. IPSec is a security protocol operating at the IP layer for negotiating encryption and authentication. IPSec may use encryption and digital signatures for everything between two hosts to provide confidentiality—making sure people cannot read information sent over the IP link, integrity—making sure any slight modification of data (from an intruder) can be detected, and authenticity—identifying parties that are communicating.
Although IPSec advantageously provides confidentiality, integrity, and authenticity, the advantages offered by IPSec require significant overhead. IPSec offers multiple security levels, so all parameters (security level, algorithms to use, key sizes . . . ) must be negotiated before each transfer. This is both complex and slows down transfer. IPSec is based on public key cryptography. Consequently, a PKI (public key infrastructure) has to be managed, which requires significant work. IPSec has a lot of security options and parameters to transfer, and consequently, secured packets grow in size which also adds to the inefficiencies of IPSec.
In highly sensitive situations, IPSec may be a very useful and appropriate solution. However, under a number of conditions, IPSec may be over-secured for the particular situation and consequently not be very efficient.
For example, iSCSI is typically intended to be implemented over local area networks. In many situations, communications over the local area network may not require confidentiality or authentication because the LAN is already secured. However, particularly when a storage area network (SAN) is connected to a local area network (LAN), there is a need to store data remotely and to be able to retrieve that data later and prove that the data has not been modified. That is, there is a need for integrity, but not necessarily a need for the confidentiality and authentication that are also provided by IPSec.
For the foregoing reasons, there is a need for providing an acceptable security level for use in storage area networks that provides data integrity yet maintains efficiency.